feat(api): password login, sliding renewal, revocable sessions

- POST /v1/auth/password|refresh|logout per contract operationIds;
  long-lived single token (32B hex, DB stores sha256 only), sliding
  renewal without rotation, logout sets sessions.revokedAt.
- SessionGuard: Bearer -> session -> user eligibility (disabled/locked/
  pending revoke access); all failures map to 401 AUTH_TOKEN_EXPIRED.
- Anti-enumeration: unknown account / wrong password / status-blocked
  share one 401 AUTH_INVALID_CREDENTIALS; unknown-account path runs a
  dummy argon2 verify to equalize timing.
- Login rate limiting (P1): in-memory account+IP sliding window,
  5 failures / 15 min -> 429; success clears. Contract amendment
  (registered): new ErrorCodes.AUTH_RATE_LIMITED added to errors.ts +
  openapi Error enum + 429 response on /auth/password; generated types
  regenerated and committed. P1a single-instance limiter; P5 needs a
  Redis-backed implementation.
- Global ValidationPipe (APP_PIPE) enforces class-validator DTOs ->
  400 VALIDATION_FAILED via the existing exception filter.

Co-Authored-By: Claude Code <noreply@anthropic.com>

services/api/src/auth/dto.ts

@@ -0,0 +1,17 @@
+// services/api/src/auth/dto.ts —— auth 端点入参 DTO（Task 13）。
+// Nest 约定用 class-validator + class-transformer（非 zod）：装饰器元数据供全局
+// ValidationPipe（app-cn.module 经 APP_PIPE 注册）校验，失败抛 BadRequestException，
+// 由全局过滤器映射 400 VALIDATION_FAILED（契约各 auth 端点的 '400' 响应）。
+// 字段约束对齐契约 LoginRequest：account/password 均为非空字符串；契约未定义
+// 长度上限（users.account 列宽 64 由入库侧保证，超长账号查无此人不构成枚举面）。
+import { IsNotEmpty, IsString } from 'class-validator';
+
+export class LoginRequestDto {
+  @IsString()
+  @IsNotEmpty()
+  account!: string;
+
+  @IsString()
+  @IsNotEmpty()
+  password!: string;
+}